Would the NSA have to do it in real time or could they do it after the communication was already sent?
If all you’re looking for is a plausibility argument that “it’s the Russians” they could leave artifacts at any time up until the forensic examiners actually investigate. This is not different from the cover-up for any other kind of crime. However, like any attempt to hide or change evidence, it works much better and there is far less likelihood of error if you do it while the crime is being committed.